I'm trying to work my way into the mail accounts of users on a mock social networking site that uses basic HTTP authentication. Brute force is not allowed by the rules and guessing passwords hasn't proved very useful.

Any tips on how to bypass or crack basic HTTP authentication? I'd greatly appreciate any help.

Hi CrzyAzn. If it's a computer forensics competition, I suppose you have to deal with some kind of .pcap file. If so, just open it with Wireshark, filter only HTTP requests (http.request) and look for a request that contains the "Authorization" header line. Once you found it, you will need to decode the base64 string that follows the "basic" (on the header line) to get the credentials.

gnix

ps: Wireshark has also a http.authbasic filter which should allow you to filter every basic HTTP authentication request. However, I've never had the opportunity to test this expression.

I'm trying to work my way into the mail accounts of users on a mock social networking site that uses basic HTTP authentication. Brute force is not allowed by the rules and guessing passwords hasn't proved very useful.

Any tips on how to bypass or crack basic HTTP authentication? I'd greatly appreciate any help.

Thanks!

If it was facebook based you could easily access it through the developers api. If its a .pcap file that requires analysis then gnix got the hook up!